[smgv]

Jira Link

EMBED-595 — [Stack 2026 Q4] Auth: tooling, dependencies and security (epic EMBED-573)

Description

Moves @web3auth/auth onto the 2026 Q4 stack, matching the shared acceptance criteria and the shape of secure-pub-sub#46 and ffjavascript #17 / #19 / #20.

Each commit is one step and can be reviewed on its own:

1. Runtime and install hardening: Node >=24.22.0, npm >=12, .nvmrc 26, devEngines, and a hardened .npmrc (min-release-age=3, allow-git=none, allow-remote=none, allow-scripts-pin=true). Adds allowScripts and npm run harden (LavaMoat at moderate).
2. Build tooling: moves to Vite+ through @toruslabs/torus-scripts@9 and @toruslabs/config@5. Builds use vp pack, linting uses Oxlint, formatting uses Oxfmt, tests use Vitest 5, and TypeScript is 7. Babel, Rollup, webpack, ESLint, Prettier, husky, lint-staged, cross-env, rimraf, tsx and tsconfig-paths are removed.
3. Strict typing: fixes the errors raised by the strict library tsconfig (noUncheckedIndexedAccess, strictNullChecks). Runtime behaviour is unchanged.
4. Dependencies: adopts @toruslabs/ffjavascript@7, @toruslabs/constants@17, @toruslabs/metadata-helpers@9, @toruslabs/session-manager@6 and @toruslabs/secure-pub-sub@5, and drops the unused @types/color. @toruslabs/customauth stays on 22.3.3, the latest release. The four new majors were published inside the 3-day cooldown, so .npmrc exempts only those package names.
5. Examples: removes unused packages and legacy ESLint, Prettier and browserslist configs from the React and Vue examples. Both move to TypeScript 7 with hardened .npmrc, allowScripts, and registry=https://registry.npmjs.org/ so a local install cannot write the JFrog mirror back into the lockfile.
6. Security: lockfile-only updates for vulnerable transitive dependencies, a Dependabot config with a 3-day cooldown, and a fix for the js/remote-property-injection code-scanning alerts in getHashQueryParams.
7. CI:
   • A new Validate workflow runs on pull requests and on pushes to master (Node 24.22 and 26) with Wiz, all actions pinned by SHA, and contents: read.
   • Adds the MetaMask security code scanner.
   • The demo deploy now uses an AWS OIDC role (vars.AWS_ROLE_ARN) and the AWS CLI instead of stored keys and the unpinned jakejarvis/s3-sync-action@master and cloudfront-update-distribution@v4.
8. Release: Changesets plus a manually triggered release-pr.yml. This PR includes a major changeset.
9. Docs: README updates, and removal of the obsolete .npmignore (files: ["dist"] already controls the package; the tarball is unchanged at 245 files, 140.9 kB).

The Torus CLI skill was intentionally not copied.

Breaking changes (major changeset)

• Requires Node >=24.22.0 and npm >=12.
• Build output targets ES2022 and is no longer transpiled by Babel. The @babel/runtime peer dependency is dropped.
• Type declarations moved from dist/lib.cjs/types/* to dist/lib.cjs/*. exports is updated, so normal subpath imports are unaffected.
• getHashQueryParams now returns only known keys: sessionId, sessionNamespace, accessToken, refreshToken, idToken, error, state, nonce and loginParams.

Before / after

Area	Before (master)	After (this PR)
Node / npm engines	>=22.x / >=10.x	>=24.22.0 / >=12
.nvmrc	>=24.x	26
.npmrc hardening	none (file was gitignored)	min-release-age=3, allow-git=none, allow-remote=none, allow-scripts-pin=true
LavaMoat harden	none	npm run harden passes at moderate, in CI
Build	torus-scripts 8 (Rollup, Babel, webpack)	Vite+ vp pack (torus-scripts 9, config 5)
Lint / format	ESLint and Prettier: 1 error, 58 warnings	Oxlint and Oxfmt via vp check: 0 errors, 144 warnings (mostly Vitest mock type parameters and tsdoc)
TypeScript	^5.9.3, non-strict profile	^7.0.2, strict library profile, tsc --noEmit clean
Tests	Vitest 4: 437 / 437	Vitest 5: 437 / 437 on Node 24.22.2 and 26.13.0
Root devDependencies	25	14
dist	121 files per format	121 files per format, same module layout
Public exports	—	same as published 11.8.3 (check:pack checks CJS and ESM keys and tsc nodenext types for all 6 subpaths)
npm audit (root)	51 (12 low, 19 moderate, 20 high)	13 (8 low, 5 moderate, 0 high)
npm audit React example	9	0
npm audit Vue example	66 (3 critical)	0
Open Dependabot alerts	179 (71 root, 87 Vue, 21 React)	expected to drop to those listed under the remaining items below
CI on pull requests	none (push only)	Validate (Node 24.22 and 26), release-notes check, security scanner
Action pinning	tags or @master	all pinned by SHA
AWS deploy credentials	stored access keys	OIDC role (vars.AWS_ROLE_ARN)
Release	manual	Changesets and release-pr.yml

Code-scanning alerts

Alert	Rule	Status
10, 11, 12	unpinned-tag	Fixed: actions pinned by SHA
17	missing-workflow-permissions	Fixed: explicit permissions
3, 4	js/remote-property-injection (getHashQueryParams)	Fixed: allowlisted keys only
1, 8, and on this PR 18, 19	js/user-controlled-bypass (auth.ts: params.error, params.nonce and loginParams from the redirect URL)	By design: these are the redirect-resume inputs. parseRedirectLoginParams ignores a loginParams value that is not valid JSON naming an auth connection, so a bad value no longer throws inside init(). Recommend dismissing as "won't fix".
16	Clear-text storage (examples/vue-example/App.vue)	False positive: stores demo UI settings only, no secrets. Recommend dismissing.

Remaining npm audit items (not force-fixed, per policy)

• 8 low, deepmerge@4.3.1: the latest release, with no patch. It remains through @toruslabs/customauth@22.3.3 (Dependabot alert 850). customauth also still nests constants@16, metadata-helpers@8 and session-manager@5, because 22.3.3 does not accept the new majors. Forcing those with an override would put undeclared majors inside customauth. It clears when EMBED-590 ships a customauth that no longer depends on deepmerge.
• 5 moderate, minimatch via eslint-plugin-tsdoc: comes through the Oxlint preset. It's dev-only, never shipped, and there's no fix in range.

How has this been tested?

On a clean npm ci under both Node 24.22.2 and Node 26.13.0 (npm 12.2.0), all of these pass: npm run harden, npm run check, npm run typecheck, npm run build, npm test (18 files, 437 tests) and npm run check:pack.

• CI on this PR: run tests (Node 24.22 and 26), release-notes, Semgrep, zizmor and Socket all pass.
• All lockfiles resolve from registry.npmjs.org. The root and both example .npmrc files pin that registry, so a machine whose global npm config points at the Consensys JFrog mirror does not rewrite the lockfiles.
• Both examples (React and Vue) pass npm ci and npm run build against the new dist, and both report 0 vulnerabilities.
• check:pack packs the tarball and installs it into a temporary ESM consumer. It checks that the CJS and ESM export keys match for all subpaths (148 / 8 / 1 / 57 / 5 / 48, identical to 11.8.3), that the injected version matches the package version, and that tsc (nodenext) resolves types for every subpath.
• Vue demo smoke test with vite preview: the page renders, and Login redirects through auth.web3auth.io/v11/start to Google sign-in. A full OAuth login wasn't completed because no test credentials were available.

Not verified yet / needs an admin

• Validate (Node 24.22 and 26), release-notes, Semgrep, zizmor and Socket pass on this PR.
• vars.AWS_ROLE_ARN exists and its trust policy allows this repo on master. The deploy job runs only on a push to master. After it succeeds, remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY secrets.
• Turn off CodeQL default setup (Settings → Code security). Until then, the security-scan / CodeQL analysis jobs fail with "CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled". The Semgrep and zizmor parts of the scanner already pass.
• Allow GitHub Actions to create pull requests (needed by release-pr.yml).
• Confirm secret scanning, push protection, CODEOWNERS teams and branch protection.
• Dismiss code-scanning alerts 18 and 19 (and 1, 8 and 16 on master) with the reasons above.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist

• My code follows the code style of this project. (run lint)
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.

---

Note

High Risk
Major release with breaking Node/engine, build output, and types layout requirements, plus stricter redirect parsing in security-sensitive auth flows and large dependency major bumps.

Overview
Major stack upgrade for @web3auth/auth: requires Node ≥24.22 and npm ≥12, ships as a major changeset, and replaces the Rollup/Babel/webpack toolchain with Vite+ (vp pack) targeting ES2022. The @babel/runtime peer is removed; .d.ts files now sit beside CJS output (dist/lib.cjs/*.d.ts) with updated exports.

Dependencies bump Torus packages to new majors (ffjavascript 7, constants 17, metadata-helpers 9, session-manager 6, secure-pub-sub 5). Dev workflow moves to Oxlint/Oxfmt, TypeScript 7, Vitest 5, Changesets, and LavaMoat npm run harden, plus a new check:pack script that validates every subpath export after pack.

Auth behavior changes: getHashQueryParams only copies allowlisted redirect keys (fixes remote-property-injection alerts). parseRedirectLoginParams is new so iframe redirects resume login only when loginParams is valid JSON naming an auth connection, instead of throwing in init(). Minor strictness fixes in PopupHandler and JRPC error stringification.

CI/release: Validate runs on PRs and master (Node 24.22 & 26: harden, check, typecheck, build, test, pack check, example builds). Adds Dependabot, MetaMask security scanner, release-notes job, release-pr.yml, and demo deploy via AWS OIDC instead of long-lived keys. Examples drop legacy ESLint/Prettier config and align with the new toolchain.

^{Reviewed by Cursor Bugbot for commit 8e892fb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​toruslabs/​config@​4.0.0 ⏵ 5.0.0	+1		-2	-6
	@​toruslabs/​oxlint-config-typescript@​1.1.0
	@​toruslabs/​constants@​15.0.0 ⏵ 17.0.0			+1	+5
	@​toruslabs/​ffjavascript@​6.0.0 ⏵ 7.0.0	+6			-1
	@​changesets/​cli@​3.0.3
	@​types/​react-dom@​19.2.3 ⏵ 19.3.0	+1		+1
	@​toruslabs/​torus-scripts@​8.0.0 ⏵ 9.0.1	+3		-7
	@​lavamoat/​harden@​0.8.1
	@​types/​react@​19.2.14 ⏵ 19.3.0
	@​vitest/​coverage-istanbul@​4.0.18 ⏵ 5.1.0			+8
	vite@​7.3.1 ⏵ 7.3.8		+32	+1
	tailwindcss@​4.2.2 ⏵ 4.3.5	+1		+1
	react@​19.2.4 ⏵ 19.3.1	+1		+1
	readable-stream@​4.7.0 ⏵ 4.8.0				+2
	typescript@​7.0.2
	@​tailwindcss/​vite@​4.2.2 ⏵ 4.3.5				+1
	@​toruslabs/​secure-pub-sub@​4.1.0 ⏵ 5.0.0	+6		+1	-2
	@​toruslabs/​metadata-helpers@​8.1.0 ⏵ 9.0.0	+1		+2	-2
	@​vitejs/​plugin-vue@​6.0.5 ⏵ 6.0.10			+1
	vue@​3.5.31 ⏵ 3.5.45			+1	+1
	@​toruslabs/​session-manager@​5.3.0 ⏵ 6.0.0	+7			-3
	react-dom@​19.2.4 ⏵ 19.3.1			+1
	viem@​2.47.6 ⏵ 2.57.17			+1	+1
	vite-plus@​1.5.0

View full report

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 09eaf2a. Configure here.}

[smgv]

Checked the review comments and the red security-scanner jobs.

Bugbot (lockfile on consensys.jfrog.io) — fixed after that review. 3dbecec rewrote the lockfiles to registry.npmjs.org and pinned registry=https://registry.npmjs.org/ in .npmrc. The root and both example lockfiles now have no JFrog URLs, and npm ci in the Validate workflow passes.

CodeQL comments on src/core/auth.ts:191 (alerts 18 and 19) — same js/user-controlled-bypass finding as alert 8 on master. nonce and loginParams come from the redirect URL on purpose, and the login result is delivered only through an origin-checked postMessage. 9a20cfa stops a bad loginParams value from throwing inside init(). The condition stays URL-driven, so CodeQL will keep flagging it. Dismiss as won't fix after merge.

security-scan / CodeQL analysis failure — the scan itself runs. The job fails when it uploads SARIF:

CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled

Semgrep and zizmor in the same workflow pass (0 results). This workflow file is identical to the one that is green on secure-pub-sub#46. The difference is this repo still has CodeQL default setup on (the separate Analyze checks). Turning that off needs repo admin (Settings → Code security → CodeQL analysis → Default setup → Disable). This token gets 403 on that API. Once it is off, these jobs should go green on the next run, and the default Analyze jobs will stop duplicating the scanner.